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SUBJECT:  Audit  Report  on  Air  Force  Research  Laboratory  Preparation  for  Year  2000 
(Report  No.  99-003) 


We  are  providing  this  audit  report  for  your  information  and  use.  This  report  is 
one  of  a  series,  the  primary  purpose  of  which  is  to  provide  the  DoD  Chief  Information 
Officer  and  other  senior  DoD  manage  with  an  independent  assessment  of  DoD 
progress  related  to  its  year  2000  efforts. 

We  appreciate  the  courtesies  extended  to  the  audit  staff.  For  additional 
information  on  this  report,  please  contact  Mr.  Raymond  A.  Spencer  at  (703)  604-9071 
(DSN  664-9071)  or  Mr.  Roger  H.  Floreice  at  (703)  604-9067  (DSN  664-9067). 

See  Appendix  C  for  the  report  distribution.  The  audit  team  members  are  listed  inside 
the  back  cover. 


Robert  J.  Lieberman 
Assistant  Inspector  General 
for  Auditing 


Office  of  the  ffispector  General,  DoD 


Report  No.  S>9-003  October  5, 1998 

(Project  No.  8AB-0030,00) 

Air  Force  Research  Laboratory  Preparation  for  Year  2000 


Executive  Summary 


Introduction.  This  report  is  one  of  a  series  being  issued  by  the  Inspector  General, 
DoD,  in  accordance  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  in  addressing  the  year  20(X)  computing  problem. 
Information  technology  systems  have  typit^y  used  two  digits  to  represent  the  year, 
such  as  “98”  representing  1998,  to  conserve  electronic  date  storage  and  reduce 
operating  costs.  With  the  two-digit  format,  however,  the  year  2WX)  is  indistinguishable 
from  1900.  As  a  result  of  the  ambiguity,  computers,  associated  systems,  and 
application  programs  that  use  dates  to  cdculate,  compare,  and  sort  could  generate 
incorrect  results  when  worldng  with  years  after  1999. 

Audit  Objectives.  The  overall  audit  objective  was  to  determine  whether  the  Air  Force 
Research  Laboratorjj  is  adequately  preparing  its  information  technology  systems  to 
resolve  date-processing  issues  for  the  year  2000  computing  problem.  Sp^ifically,  the 
audit  determined  whether  the  Air  Force  Research  Laboratory  has  complied  with  the 
Air  Force  Materiel  Command  Year  2000  Program  Management  Plan. 

Audit  Results.  The  Air  Force  Research  Laboratory  had  established  a  process  for 
determining  whether  the  laboratoty  has  a  potential  year  2000  impact  and  was  actively 
determining  its  systems’  vulnerability  to  the  date-processing  problem.  However,  the 
Air  Force  Research  Laboratory  had  not  met  the  required  timeframes  of  the  Air  Force 
Materiel  Command  Year  2000  Program  Management  Plan  for  identifying  and  resolving 
any  year  20(X)  impact  for  infrastructure  items.  The  Air  Force  Research  Laboratory 
officials  had  emphasized  the  importance  of  identi^ing  and  resolving  potential 
year  2000  problems,  identified  automated  information  systems  that  needed  year  2000 
corrections,  be^  conducting  a  comprehensive  infrastructure  inventory,  begun 
reviewing  ongoing  research  efforts  for  year  2000  concerns,  and  modified  contracts  for 
year  2000  compliance,  where  applicable.  As  a  result,  although  the  Air  Force  Research 
Laboratory  was  somewhat  behind  overall  DoD  schedule  guidelines  for  the 
infrastructure  items,  an  effective  effort  was  under  way  for  minimizing  any  year  2000 
date-processing  problem. 

Management  Comments.  We  provided  a  draft  of  this  report  on  July  27,  1998. 
Although  not  required  to  comment,  the  Chief  Information  Officer,  Air  Force  Research 
Laboratory,  agr^  with  the  report  and  suggested  minor,  which  were  incorporated  in 
this  final  report.  See  Part  IQ  for  the  complete  text  of  tiie  comments. 
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Part  I  -  Audit  Results 


Audit  Background 


Year  2000.  The  year  2000  problem  is  the  term  most  often  used  to  describe  the 
potential  failure  of  information  technology  systems  to  process  or  perform 
date-related  functions  before,  on,  or  after  the  turn  of  the  century.  The 
year  2000  problem  is  rooted  in  the  way  that  automated  information  systems 
record  and  compute  dates.  For  the  past  several  decades,  systems  have  typically 
used  two  digits  to  represent  the  year,  such  as  “98”  representing  1998,  to 
conserve  on  electronic  data  storage  and  to  reduce  operating  costs.  With  the 
two-digit  format,  however,  the  year  2000  is  indistinguishable  from  1900.  As  a 
result  of  the  ambiguity,  computers  and  associated  systems  and  application 
programs  that  use  dates  to  calculate,  compare,  and  sort  could  generate  incorrect 
results  when  working  with  years  following  1999.  Calculation  of  year  2000 
dates  is  further  complicated  because  the  year  2000  is  a  leap  year,  the  first 
century  leap  year  since  1600,  and  the  computer  systems  and  applications  must 
recognize  February  29,  2000,  as  a  valid  date. 

Because  of  the  potential  failure  of  computers  to  run  or  function  throughout  the 
Government,  the  President  issued  an  Executive  Order,  “Year  2000 
Conversion,”  February  4,  1998,  making  it  policy  that  FaJeral  agencies  ensure 
that  no  critical  Federal  program  experiences  disruption  because  of  the  year  2000 
problem  and  that  the  head  of  each  agency  ensure  that  efforts  to  address  the  year 
2000  problem  receive  the  highest  priority  attention  in  the  agency. 

DoD  Year  2000  Management  Strategy.  In  his  role  as  the  DoD  Chief 
Information  Officer,  the  Acting  Assistant  Secretary  of  Defense  (Command, 
Control,  Communications,  and  Intelligence)  issued  the  final  version  of  the 
“DoD  Year  2000  Management  Plan”  in  April  1997.  The  DoD  Year  2000 
Management  Plan  ^ovides  the  overall  DoD  strategy  and  guidance  for 
inventorying,  prioritizing,  repairing  or  retiring  systems,  and  monitoring 
progress.  The  DoD  Year  2000  Management  Plan  states  that  the  DoD  Chief 
Information  Officer  has  overall  responsibility  for  overseeing  the  DoD  solution 
to  the  year  2000  problem.  Also,  tiie  DoD  Year  2000  Management  Plan  makes 
the  DoD  Components  responsible  for  the  five-phase  year  2000  management 
process.  The  “DoD  Management  Plan,  For  Signature  Draft  Version  2.0,”  June 
1998,  accelerates  the  target  completion  dates  for  the  renovation,  validation,  and 
implementation  phases.  The  new  target  completion  date  for  implementation  of 
mission-critical  systems  is  December  31,  1998. 

In  a  January  20,  1998,  memorandum  for  the  heads  of  executive  d^artment  and 
agencies,  the  Office  of  Management  and  Budget  established  a  new  target  date  of 
March  1999  for  implementing  all  corrective  actions  for  the  renovation  phase  and 
January  1999  for  the  validation  phase. 

The  Secretary  of  Defense  issued  the  memorandum  “Year  2000  Compliance”  on 
August  7, 1998,  and  stated  that  the  year  2000  computer  problem  is  a  critical 
national  Defense  issue.  He  also  stated  that  the  Military  Departments  will  be 
responsible  for  ensuring  that  the  list  of  mission-critical  systems  under  their 
respective  purview  is  accurately  reported  in  the  DoD  year  2000  database 
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effective  October  1,  1998.  The  DoD  Components  must  report  and  explain  each 
change  in  mission-critical  designation  to  the  Office  of  the  Assistant  Secretary  of 
Defense  (Command,  Control,  Communications,  and  Intelligence)  within 
1  month  of  the  change. 

The  Deputy  Secretary  of  Defense  issued  the  memorandum  “Year  2000  (Y2K) 
Verification  of  National  Security  Capabilities”  on  August  24,  1998.  The 
memorandum  states  that  each  mlit^  Department  must  certify  that  it  has  tested 
the  information  technology  and  national  security  system  year  2000  capabilities 
of  its  respective  Component’s  systems  in  accordance  with  the  DoD  Management 
Plan. 

Air  Force  Materiel  Command  Year  2000  Program  Management  Plan.  The 
Air  Force  Materiel  Command  Year  2000  Program  Management  Plan  (the 
Management  Plan)  implements  the  DoD  Year  2000  Management  Plan.  The 
Management  Plan  establishes  a  five-phase  approach  for  automated  information 
systems  and  a  three-phase  approach  for  infr^tructure  systems.  The 
Management  Plan  provides  the  Air  Force  strategy  and  management  approach  to 
satisf^g  the  year  2000  problem.  The  Management  Plan  discusses  each  of  the 
five  phases  identified  in  the  DoD  Year  2000  Management  Plan  and  establishes 
Air  Force  activity  target  completion  dates  for  each  phase  for  automated 
information  systems.  The  five  phases  for  automated  information  systems  are  as 
follows: 

•  Phase  I  -  Awareness.  FamHiarixe  Air  Force  personnel  with  the  possible 
year  2000  impact,  define  the  year  2000  problem,  decide  the  overall  approach, 
and  obtain  high-level  management  support.  Awareness  was  to  be  accomplished 
through  memorandums,  articles  in  Am  Force  publications,  e-mails,  status 
briefings,  site  visits,  messages,  and  oth^  means  as  appropriate.  Target 
completion  of  the  awareness  phase  was  June  30,  1997. 

•  Phase  n  -  Assessment.  Determine  the  impact  of  year  2000  on  the 
organization’s  inventory,  including  hardware,  software,  and  firmware 
contracts;  develop  accq)table  solutions,  estimate  resource  requirements;  and 
develop  activity  contingency  plans.  Target  completion  of  the  assessment  phase 
was  October  31,  1997. 

•  Phase  in  -  Renovation.  Develop  the  actual  correction  of  the  year  2000 
problems  for  each  system.  Target  completion  of  the  renovation  phase  was 
June  30,  1998. 

•  Phase  IV  -  Validation.  Test  and  verify  the  correctness  of  the  renovated 
or  replaced  system.  All  systems  must  undergo  the  vsdidation  phase,  including 
systems  assessed  as  having  no  year  2000  impact.  Target  completion  of  the 
validation  phase  was  September  30,  1998. 

•  Phase  V  -  Implementation.  Systems  are  considered  fully  operational 
after  being  certified  as  year  2000  compliant.  Target  completion  of  the 
implementation  phase  is  December  31,  1998. 
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The  Management  Plan  also  provides  a  three-phase  approach  for  identifying 
year  2000  problems  for  infi^tructure  systems.  The  three  phases  are  as  follows: 

•  Phase  I  -  Inventory.  Develop  an  inventory  of  infrastructure  systems  and 
identify  the  mission  risks.  Target  completion  of  the  inventory  phase  was 
March  31,  1998. 

•  Phase  n  -  Assessment.  Determine  the  year  2000  compliance  on  the 
infrastructure  systems  inventoried.  Target  completion  of  the  assessment  phase 
was  September  30,  1998. 

•  Phase  m  -  Implementation.  Implement  the  actual  correction  of  the  year 
2000  problems  for  each  system.  Target  completion  of  the  implementation  phase 
was  May  31,  1999. 

Air  Force  Research  Laboratory.  The  Air  Force  Research  Laborato^  (AFRL) 
was  established  in  October  1997  by  the  consolidation  and  reorganization  of  the 
four  Air  Force  research  laboratories  (Wright  Laboratory,  Rome  Laboratory, 
Armstrong  Laboratory,  and  PhilUps  Laboratory)  and  other  research 
organizations.  The  AFRL  is  comi^sed  of  10  directorates  located  at  10  locations 
throughout  the  United  States.  To  identify  the  year  2000  impact  on  the  AFRL, 
AFRL  officials  were  using  the  Management  Plan  as  the  approach  to  assess  and 
resolve  its  potential  date-processing  problem. 


Audit  Objectives 

Our  primary  audit  objective  was  to  determine  whether  AFRL  is  adequately 
preparing  its  information  technology  systems  to  resolve  date-processing  issues 
for  the  year  2000  computing  problem.  Specifically,  the  audit  determined 
whether  the  AFRL  has  compued  with  the  Management  Plan.  Appendix  A 
describes  the  audit  scope  and  methodology.  Appendix  B  summarizes  prior  audit 
coverage. 
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Status  of  the  Air  Force  Research 
Laboratory  Year  2000  Program 

The  Air  Force  Research  Laboratory  (AFRL)  had  established  a  process 
for  determining  whether  the  laboratory  has  a  potential  year  2000  impact 
and  was  actively  determining  its  systems’  vulnerability  to  the  date¬ 
processing  problem.  However,  AFRL  had  not  met  the  required 
timeframes  in  the  Air  Force  Materiel  Command  Year  2000  Program 
Management  Plan  for  idoitifying  and  resolving  year  2000  impact  for 
infrastructure  items.  The  AFRL  officials  had  emphasized  the  importance 
of  identifying  and  resolving  potential  year  2000  problems,  identified 
automated  information  systems  that  needed  year  2000  corrections,  had 
begun  conducting  a  comprehensive  inventory  of  infrastructure  systems, 
had  begun  reviewing  ongoing  research  efforts  for  year  2000  concerns, 
and  were  modifying  contracts  for  year  2000  compliance,  where 
applicable.  As  a  result,  although  the  AFRL  was  somewhat  behind 
overall  DoD  schedule  guidelines  for  the  infrastructure  items,  an  effective 
effort  was  under  way  for  minimizing  any  year  2000  date-processing 
problem. 


Awareness 


The  AFRL  had  completed  the  awareness  phase  for  automated  information 
systems  as  required  by  the  Air  Force  Materiel  Command  Year  2000  Program 
Management  Plan  (the  Management  Plan).  The  Management  Plan  required 
Air  Force  organizations  to  complete  the  awareness  phase  by  June  30,  1997. 
The  intent  of  the  awareness  phase  is  to  make  Air  Force  personnel  aware  of 
year  2000  concerns  and  demonstrate  upper  level  management  support  in 
identifying  the  potential  for  exposure  to  year  2000  problems  at  Air  Force 
organizations. 


AFRL  officials  had  properly  informed  personnel  of  year  2000  issues  through 
memorandums,  briefings,  e-mails,  messages,  and  other  means.  The 
Commander,  AFRL,  issued  a  memorandum  on  September  19,  1997,  that 
emphasized  the  importance  of  addressing  year  2000  impact  at  the  laboratory.  In 
the  memorandum,  the  Commander  established  a  Year  2000  Program  Office  that 
would  be  responsible  for  identifying  and  assessing  all  systems  and  infrastructure 
and  establishing  year  2000  representatives  in  each  of  the  laboratory’s 
directorates.  In  addition,  the  memorandum  directed  that  all  program  managers 
review  research  programs  to  identify  potential  year  2000  problems,  identify  the 
year  2000  resolutions,  and  identify  costs  associated  with  resolving  the  year  2000 
problems.  The  Commander,  AF^,  reemphasized  the  importance  of 
identifying  and  resolving  potential  year  2000  problems  at  tiie  laboratory  in  a 
later  memorandum  issu^  on  November  7,  1997. 
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Inventory  and  Assessment  of  Automated  Information  Systems 

The  Management  Plan  states  that  during  the  assessment  phase,  all  automated 
information  systems  will  be  inventoried  and  analyzed  to  determine  the  system’s 
potential  year  2000  impact,  and  a  decision  would  be  made  on  whether  the 
systems  should  be  retained,  merged  into  another  system,  or  terminated.  The 
Management  Plan  also  requires  die  development  of  a  contingency  plan  that  is 
based  on  the  risk  assessments  to  the  year  2000  impact  and  actions  to  be  taken  if 
year  2000  corrections  are  not  accomplished  on  time.  In  addition,  the 
Management  Plan  requires  the  Year  2000  Program  Manager  to  develop  an 
estimate  for  the  cost  of  making  systems  year  2000  compliant.  The  Management 
Plan  required  the  assessment  phase  to  be  completed  by  October  31,  1997. 

AFRL  conducted  an  inventory  of  automated  information  systems  and  identified 
eight  systems  that  needed  to  be  assessed  for  a  year  2000  impact.  AFRL 
assessment  of  the  eight  automated  information  systems  identified  that  all  the 
systems  had  a  year  2000  problem.  Later,  two  automated  information  systems 
were  fixed  and  certified,  and  the  remaining  systems  were  scheduled  to  be  fixed 
by  March  1999.  AFRL  reported  that  of  the  six  automated  information  systems, 
three  were  mission  essentid  and  three  were  non-mission  essential.  AFRL 
reported  that  no  additional  cost  would  be  associated  with  fixing  the 
six  automated  information  systems  because  the  year  2000  corrections  would  be 
accomplished  through  normal  system  upgrades. 


Inventory  and  Assessment  of  Infrastructure  Systems 

The  Man^ement  Plan  provided  different  requirements  for  Air  Force 
organizations  in  reviewing  year  2000  potential  problems  for  infrastructure 
systems.  However,  the  Management  Plan  requires  organizations  to  inventory, 
assess,  and  implement  corrections  for  systems  identifi^  with  year  2000 
programs. 

Inventoiy  of  Infrastructure  Items.  The  AFRL  conducted  an  initial 
inventory  of  hardware,  software,  firmware,  and  infrastructure  systems  in 
April  1998.  The  initkd  inventory  included  aj^roximately  81,000  items  of 
systems  and  equipment.  While  conducting  the  initial  inventory,  year  2000 
directorate  representatives  also  began  assessing  whether  systems  and  equipment 
were  year  2000  compliant,  determining  the  system’s  mission  criticality,  and 
identifying  costs  associated  with  resolving  any  date-processing  problems. 

Assessing  Systems  and  Equipment  for  Year  2000  Impact.  The 
directorate  representatives  rqxirted  81,000  systems  and  equipment,  rqiresenting 
80  percent  of  all  systems  and  equipment,  to  tiie  AFRL  Year  2000  Program 
Manger  in  the  initial  inventory.  Of  the  81,000  systems  and  equipment 
rqxir^,  12, 100  systems  and  equipment  were  year  2000  compliant, 

1,000  systems  and  equipment  were  non-compliant,  and  68,000  systems  and 
equipment  still  n^  to  be  reviewed  for  year  2000  compliance. 
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Mission  Criticality.  The  directorate  representatives  categorized  systems 
and  equipment  on  each  system’s  importance  to  the  laboratory’^  mission.  Of  the 
81,000  systems  and  equipment,  none  were  DoD  mission  critical.  Of  the 
81,000  systems  and  equipment,  10,200  systems  were  mission  essential, 

14,500  systems  were  non-mission  essential,  29,200  systems  were  mission 
impaired,  and  the  remaining  27,100  systems  stiU  needed  to  be  reviewed  for 
mission  criticality. 

Cost  Associated  With  Year  2000.  The  directorate  representatives 
identified  the  cost  associated  with  year  2000  compliance  in  the  initial  inventory. 
They  reported  that  an  estimated  $53,700  was  needed  to  repair  or  replace 
systems,  and  that  the  estimated  cost  may  increase. 

The  AFRL  Year  2000  Program  Manager  required  the  directorate  representatives 
to  submit  a  complete  inventory  by  June  30,  1998,  and  to  submit  assessments  of 
the  systems  and  equipment  by  September  30,  1998.  The  Program  Manager 
indicated  that,  upon  completion  of  the  inventory,  the  directorate  representatives 
and  the  Progi^  h^ager  were  to  begin  developing  contingency  plans  based 
upon  the  assessments. 


Assessment  of  Current  Research  Programs 

AFRL  officials  had  taken  actions  to  require  the  assessment  of  current  research 
programs  and  their  interfaces  for  the  potential  year  2000  impact.  The  Chief 
Information  Officer  directed  the  AFI^  program  managers  and  engineers  to 
review  existing  contractual  research  efforts  and  potential  system  interfaces  using 
an  Air  Force  year  2000  compliance  checklist.  Program  managers  and  engineers 
identified  year  2000  compatibility  issues  and  required  contracting  officials  to 
modify  the  contracts  to  incorporate  the  appropriate  year  2000  language. 


Contracting 

The  Acting  Assistant  Secret^  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  issued  a  policy  memorandum  to  the 
Secretaries  of  the  Military  Departments  and  the  Directors  of  the  Defense 
Agencies  on  “A^uisition  of  Year  2000  Compliant  Information  Technology  (IT) 
and  Bringing  Existing  IT  into  Compliance,  ”  December  18,  1997.  The  policy 
states  that  all  information  technology  acquired  by  the  Military  Departments  and 
Defense  agencies  must  be  year  2000  compliant.  The  memorandum  requires  that 
technical  and  contracting  personnel  review  information  technology  contracts  and 
other  acquisition  instruments  to  determine  whether  modifications  to  the  contracts 
are  necessary.  The  memorandum  states  that  orders  for  information  technology 
must  not  be  placed  on  a  contract  or  other  acquisition  instrument  unless  the 
information  technology  purchase  is  year  2000  compliant.  The  Air  Force 
Materiel  Command  Year  2000  Program  Management  Plan,  “Compliance  and 
Certificate  Strategy  for  Systems,”  states  that  systems  currently  in  acquisition  are 
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required  to  be  year  2000  compliant.  In  April  1998,  the  Air  Force  Chief 
Information  Officer  issued  guidance  on  year  2000  wording  in  information 
technology  contracts. 

In  October  1997,  the  Air  Force  reorganized  its  research  laboratories  and  divided 
the  information  technology  responsibilities  between  the  former  Rome 
Laboratory,  Rome,  New  York,  and  the  former  Wright  Laboratory,  Dayton, 
Ohio.  Both  locations  perform  information  technology  research  for  the 
Air  Force  and  are  supported  by  contracting  directorates  at  the  respective  sites. 

Contracting,  at  the  Rome  Research  Site.  The  contracting  officials  and 
engineers  at  the  Rome  Research  Site  reviewed  research  contracts  in  accordance 
with  the  Acting  Assistant  Secretary  of  Defense  (Command,  Control, 
Communications,  and  Intelligence)  memorandum.  Contracting  officials  were 
aware  of  the  year  2000  issues  before  the  release  of  the  Assistant  Secretary’s 
memorandum,  and  they  coordinated  with  the  Rome  program  managers  and 
engineers  to  ensure  that  year  2000  compliant  language  was  in  all  statements  of 
work.  Hie  Rome  contracting  directorate  had  award^  121  information 
technology  contracts  for  FY  1998  at  the  time  of  our  audit.  The  auditors 
judgmenmy  selected  and  reviewed  10  of  the  121  contracts  and  determined  that 
each  contained  the  appropriate  year  2000  provision,  as  required. 

The  Operational  Contracting  Branch  supports  the  Rome  Research  Site  by 
purchasing  vendor-supplied  hardware  items.  The  items  consist  primarily  of 
computer  hardware  ordered  by  General  Services  Administration  contracts. 
Discussions  with  officials  at  the  Operational  Contracting  Branch  determined  that 
General  Service  Administration  contracts  require  acquisition  items  to  be 
year  2000  compliant. 

Contracting  at  the  Wright  Research  Site.  AFRL  contracting  officials 
at  the  Wright  Research  Site  were  responsible  for  issuing  contracts  for 
information  technology  research,  whole  Aeronautical  Systems  Center,  Air  Force 
Materiel  Command,  contracting  officials  were  responsible  for  issuing  contracts 
for  hardware  and  software. 

Although  information  technology  research  program  managers  and  engineers 
were  required  to  review  ongoing  research  programs  for  year  2000  compliance, 
Wright  Research  site  contracting  officials  had  not  reviewed  the  existing 
information  technology  research  efforts  for  year  2000  compliance.  Based  on  the 
AFRL  program  managers’  and  engineers’  reviews,  the  engineers  would  request 
contracting  officials  to  modify  contracts  for  year  2000  considerations,  where 
required.  For  fiiture  research  contracts,  Wright  Research  site  contracting 
officials  revised  the  jprocedures  for  developing  procurement  strategies  to  require 
year  2000  considerations  from  contract  requesters  before  contract  award. 

The  Operational  and  Central  Support  Contracting  Division  at  the  A^onautical 
Systems  Center  provides  hardware  and  software  contracting  support  to  AFRL. 
Tne  Operational  and  Central  Support  Contracting  Division  issu^  a 
memorandum  on  April  9,  1998,  that  directed  contracting  officers  to  include  the 
Federal  Acquisition  Regulation,  S^tion  39.002,  “Acquisition  of  Information 
Technology,”  year  2000  compliant  language  in  all  contracts  and  contract  orders. 
In  addition,  contracting  officers  were  required  to  ask  the  program  managers  or 
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engineers  whether  existing  contracts  for  hardware  and  software  needed  to  be 
mailed  for  the  year  2000  compliance  requirement.  A  review  of  the 
Operational  and  Central  Support  Contracting  Division  contract  files  and 
discussions  with  contracting  officials  indicated  that  the  contracting  officials  had 
not  complied  with  the  policy  memorandum,  although  the  contracting  officials 
were  in  the  process  of  modifying  the  contracts. 


Conclusion 


AFRL  is  behind  the  Management  Plan  schedule  for  inventorying  infrastructure 
systems.  However,  we  believe  that  AFRL  established  an  effective  process  that 
should  assist  in  minimizing  any  year  2000  date-processing  problems. 


Management  Comments 

Although  not  required  to  comment,  the  Chief  Information  Officer,  Air  Force 
Research  Laborato^,  a^eed  witii  the  report  and  offered  minor  changes,  which 
were  incorporated  in  this  final  report. 
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Appendix  A.  Audit  Process 


This  rex)ort  is  one  in  a  series  being  issued  by  the  Ins|)ector  General,  DoD,  in 
accord^ce  with  an  informal  partnership  with  the  Chief  Information  Officer, 
DoD,  to  monitor  DoD  efforts  to  address  the  year  2000  computing  challenge. 
For  a  listing  of  audit  projects  addressing  this  issue,  see  the  year  2000  webpage 
on  IGNET  (ht^://www.ignet.gov/). 


Scope 

Work  Performed.  We  reviewed  and  evaluated  the  AFRL  progress  in  resolving 
the  year  2000  computing  issue  at  Wright-Patterson  Air  Force  Base  and  the 
Rome  Information  Tectmology  Site;  compared  the  actions  with  die  Air  Force 
Materiel  Command  Year  2000  Program  Management  Plan;  conducted 
discussions  with  technical  and  contracting  officials;  and  evaluated  year  2000 
documentation,  where  available. 

DoD-Wide  Corporate-Level  Government  Performance  and  Results  Act 
Goals.  In  response  to  the  Government  Performance  and  Results  Act,  DoD  has 
established  6  DoD-wide  corporate-level  performance  objectives  and  14  goals  for 
meeting  those  objectives.  Tnis  report  pertains  to  achievement  of  the  following 
objective  and  go^: 

•  Objective;  Prepare  now  for  the  uncertain  future. 

•  Goal:  Pursue  a  focused  modernization  effort  that  maintains  U.S. 
qualitative  superiority  in  key  warfighting  capabilities.  (poD-3) 

DoD  Functional  Area  Reform  Goals.  Most  major  DoD  functional  areas  have 
also  established  performance  improvement  reform  objective  and  goals.  This 
report  pertains  to  achievement  for  the  following  functional  area  objective  and 
goal: 

Information  Technology  Management  Functional  Area. 

•  Objective:  Provide  service  that  satisfies  customer  information 
ne^s. 

•  Goal:  Upgrade  technology  base.  (rrM-2.3) 

General  Accounting  Office  High-Risk  Area.  In  its  identification  of  risk 
areas,  the  General  Accounting  Office  has  specifically  designated  risk  in 
resolution  of  the  year  2000  problem  as  high.  This  report  provides  coverage  of 
that  problem  and  of  the  overall  Information  Management  and  Technology  high- 
risk  area. 


12 


_ Appendix  A.  Audit  Process 

Methodology 


Audit  Type,  Dates,  and  Standards.  We  performed  this  economy  and 
efficiency  audit  from  May  through  June  1998,  in  accordance  with  the  auditing 
standards  issued  by  the  Comptroller  General  of  the  United  States,  as 
implemented  by  the  Inspector  General,  DoD.  We  did  not  rely  on  computer- 
processed  data  or  statistical  sampling  procedures  to  develq>  conclusions  on  this 
audit. 

Contacts  During  the  Audit.  We  visited  or  contacted  individuals  and 
organizations  within  DoD  and  the  Air  Force.  Further  details  are  available  on 
request. 

Management  Control  Program  Review.  We  did  not  review  the  management 
control  program  for  this  audit  because  the  Secreta^  of  Defense  Letter  of 
Assurance  for  FY  1997  recognizes  the  year  2000  issue  as  a  material 
management  control  weakness  area. 
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The  General  Accounting  Office  and  the  Inspector  General,  DoD,  have 
conducted  multiple  reviews  related  to  year  2000  issues.  General  Accounting 
Office  reports  can  be  accessed  over  die  Internet  at  http:/www.gao.gov. 
Inspector  General,  DoD,  reports  can  be  accessed  over  the  Internet  at 
http:/www.dodig.osd.mil. 


Air  Force  Audit  Agency 


The  Air  Force  Audit  Agency  had  conducted  several  audits  related  to  Air  Force 
Research  Laboratory  year  2000  issues.  The  audits  listed  below  concern  Phillips 
Laboratory  and  the  Human  Systems  Center,  which  are  now  under  the  Air  Force 
Research  Laboratory  due  to  the  October  1997  reorganization. 

Air  Force  Audit  Agency  Rqrart  No.  23098011,  “Systems  Assessments  for  the 
Year  2000  Program,  Air  Force  Research  Laboratory,  Phillips  Research  Site, 
Kirkland  Air  Force  Base,  New  Mexico,”  March  17,  1998. 

Air  Force  Audit  Agency  Rqwrt  No.  230970014,  “Inventory  Status  of  the 
Year  2000  Program,  Phillips  Laboratory,  Kirkland  Air  Force  Base,”  June  9, 
1997. 

Air  Force  Audit  Agency  Report  No.  41097030,  “Inventory  Status  for  the  Year 
2000  Program,  Human  Systems  Center,  Brooks  Air  Force  Base,  Texas,” 

May  29,  1997. 
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Office  of  the  Secretary  of  Defense 

Under  Secretary  of  Defense  for  Acquisition  and  Technology 
Director,  Defense  Procurement 
Director,  Defense  Logistics  Studies  Information  Exchange 
Under  Secretary  of  Defense  (Comptroller) 

Deputy  Chief  Financial  Officer 
Deputy  Comptroller  (Program/Budget) 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications,  and 
Intelligence),  Year  2000  Oversight  and  Contingency  Planning  Office 
Assistant  Secretary  of  Defense  (Public  Afhurs) 


Department  of  the  Army 

Chief  Information  Officer,  Army 
Insp^tor  General,  Department  of  the  Army 
Auditor  General,  Department  of  the  Army 


Department  of  the  Navy 

Assistant  Secretary  of  the  Navy  (Financial  Management  and  Comptroller) 

Auditor  General,  Department  of  the  Navy 

Chief  Information  Officer,  Navy 

Inspector  General,  Department  of  the  Navy 

Inspector  General,  Marine  Corps 


Department  of  the  Air  Force 

Assistant  Secretary  of  the  Air  Force  (Financial  Management  and  Comptroller) 

Commander,  Air  Force  Materiel  Command 

Auditor  General,  Department  of  the  Air  Force 

CommandCT,  Air  Force  Research  Laboratory 

Chief  Information  Officer,  Air  Force 

Inspector  General,  Department  of  the  Air  Force 
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Other  Defense  Organizations 

Director,  Ballistic  Missile  Defense  Organization 

Chief  Information  Officer,  B^dlistic  Missile  Defense  Organization 
Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Information  Systems  Agency 

Inspector  General,  Defense  Biformation  Systems  Agency 
Chief  Information  Officer,  Defense  Information  Systems  Agency 
United  Kingdom  Liaison  Officer,  Defense  Information  Systems  Agency 
Director,  Defense  Logistics  Agency 
Director,  Defense  Security  Assistance  Agency 
Director,  National  Security  Agency 

Inspector  General,  National  Security  Agency 
Inspector  General,  Defense  Intelligence  Agenc)r 
Inspector  General,  National  Imagery  and  Mapping  Agency 
Inspector  General,  National  Reconnaissance  Office 


Non-Defense  Federal  Organizations  and  Individuals 

Office  of  Management  and  Budget 

Office  of  Information  and  Regulatory  Affairs 

Technical  Information  Center^  National  Security  and  International  Affairs  Division, 
General  Accounting  Office 

Director,  Defense  Information  and  Financial  Management  Systems,  Accounting  and 
Information  Management  Division,  General  Accounting  Office 

Chairman  and  ranking  minority  member  of  each  of  the  following  congressional 
committees  and  subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Governmental  Affairs 

Senate  Special  Committee  on  the  Year  2000  Technology  Problem 

House  Committee  on  Appropriations 

House  Subcommittee  on  National  Security,  Committee  on  Appropriations 
House  Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  Government  Management,  Information,  and  Technology, 
Committee  on  Government  Reform  and  Oversight 
House  Subcommittee  on  National  Security,  International  Affairs,  and  Criminal 
Justice,  Committee  on  Government  Reform  and  Oversight 
House  Committee  on  National  Security 
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DEPARTMENT  OF  THE  AIR  FORCE 

Am  FORCE  RESEARCH  LABORATORY 
WRKMr-PATTERSON  AIR  FORCE  BASE  OHIO  4S433 

31  Axig  98 


MEMORANDUM  FOR  OFFICE  OF  THE  INSPECTOR  GENERAL.  DoD 
400  Army  Navy  Drive 
Arlington,  VA  22202-2884 

FROM;  AFRL/CCI 

SUBJECT:  Draft  Audit  Report  on  Air  Force  Research  Laboratory  (AFRL)  Preparation  for  Year 
2000  (Project  No.  8AB-0030.00) 


1  AFRL  appreciates  the  thorough  job  the  inspectors  did  in  auditing  AFRL’s  preparation  for  the 
year  2000.  This  report  will  provide  all  levels  of  the  Air  Force  and  DoD  vital  infonmation 
demonstrating  AFRL’s  diligence  in  resolving  ftte  date  processing  issues  associated  with  the  year 

2000. 

2  Attached  ate  the  management  comments  to  the  Draft  Audit  Report  dated  27  July  199R  These 
comments  were  already  provided  electronicaUy  to  your  office  for  easier  incteioinnfte  final 
report  If  there  are  any  questions  about  our  comments,  please  contact  the  AFRL  Y2K.  Program 
Manager,  Major  Michael  J.  Monroe,  DSN  986-9756  or  (937)  656-9756. 

DENNIS  F.  MARKISELLO,  Colonel,  USAF 
Chief  Information  Officer 

1  Atch 
Comments 
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These  two  actions  are  interdependent.  You  can’t  singly  go  out  and  count  all  the  computer 
controlled  things  in  your  organization,  you  need  to  start  by  looking  at  your  mission  and  focusing 
on  the  computer-controlled,  date-cognizant  items  you  depend  upon. 

Throughout  the  phases,  you’ll  track  resolution  status  of  the  items  you  identified  and  manage  the 
mission  risks. 

Determine  the  item's  operational  impact  to  your  mission.  Use  the  Mission  Criticality  Definitions 
in  Chapter  0.  The  trial  inventory  of  Scott  Air  Force  Base  revealed  that  mission  criticality  is  in 
the  eyt  of  the  beholder — everyone  thinks  his  mission  is  critical.  Mission  Criticality  Group  I 
(Mission  Critical)  is  for  wartime  critically  or  life  threatening.  Mission  ri^  must  be  scrubbed 
at  the  base  or  wing  or  MAJCOM  level  based  upon  operational  impact  so  you  can  effectively 
“rack  and  stack”  fix  priorities.  Although  the  library’s  computerized  check-out  system  is  critical 
for  their  operation,  it’s  not  nearly  as  critical  as  the  flight-line  automated  test  equipment. 

Inventory  and  identify  risks  from  both  centrally  managed  and  locally  managed  items.  Although 
the  centi^y  managed  items  may  be  out  of  your  control,  they  still  impact  your  mission-— you 
need  to  account  for  their  failure. 

Don’t  forget  to  examine  leased  equipment  and  services  6om  external  service  providers.  For 
example,  call  the  local  power  company  to  ensure  they’ll  continue  to  provide  service. 

You  should  record  your  inventoiy  on  the  spreadsheet  available  from  the  Air  Force  Year  2000 
web  page  (http;//yeai2000.afjnil,  under  the  infrastructure  heading).  It’s  a  useful  tool  for 
managing  your  risks  and  is  the  key  mechanism  for  reporting  mission  critical  items  (see  reporting 
in  Chapter  0). 

Chapter  0  provides  a  limited  list  of  potential  Year  2000  impacts.  Another  resource  is  AFPAM 
91  -214,  “Operational  Risk  Management  (ORM)  Implementation  and  Execution.”  It  describes 
the  ORM  process  which  can  be  used  to  perform  a  Year  2000  mission  risk  assessment  It  is 
available  on  the  World  Wide  Web  at  http://afpubs.hq.af.mil/elec-products/pubs-pages. 

Exit  criteria 

Items  identified 

Assessment  Phase 

Purpose 

Assess  situation 

Actions 

Determine  compliance 

Determine  the  Y2K  compliance  of  the  items  you  identified.  You  probably  can’t  tell  if  a 
computer-controlled,  date-recognizing  item  is  Year  2000  conqrliant  just  by  looking  at  it. 
Whenever  possible,  use  central  sources  of  compliance  information.  Air  Force-level  functional 
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agencies  will  support  MAJCOMs,  FOAs,  DRUs,  and  subordinate  units  by  researching  and 
sharing  it  throu^  the  Air  Force  Y2K  Program  Office. 

Start  your  search  for  compliance  information  at  die  Air  Force  Year  2000  web  page, 
http://year2000.af.mil.  We  continue  to  improve  the  amount  and  quality  of  the  compliance  and 
certification  information  available  When  necessary,  contact  central  managers  and  fimctional 
staffs  to  request  compliance  information  that  you  can’t  find  on  the  Air  Force  Web  page  (we  will 
post  information  on  centrally  managed  items  and  functional  area  items  as  it  becomes  available). 
Only  as  a  last  resort  should  field  units  spend  resources  to  determine  an  item’s  compliance. 
Unfortunately,  compliance  information  isn’t  always  available — another  reason  why  contingency 
plans  are  important.  Read  the  important  information  on  product  compliance  in  Chapter  0. 

It’s  important  to  understand  the  difference  between  Y2K  compliance  and  Y2K  certification. 
Read  ffie  important  information  on  product  certification  in  Chapter  0.  There  is  no  Air  Force 
requirement  to  certify  (test)  every  infi:astructure  item. 

Mission  risk  assessment 

Armed  with  compliance  information,  assess  die  mission  risks  identified  in  the  inventory  phase. 
Determine  possible  risk  mitigation  actions.  For  example,  you  can  mitigate  the  risk  fiom  a  failed 
traffic  light  by  rqiaiiTng  the  problem,  posting  a  traffic  cop  at  the  li^t  when  it  foils,  temporarily 
instiling  stop  and  yield  signs,  or  by  ignoring  the  problem  since  die  operational  risk  is  low. 

The  Year  2000  problem  is  a  lot  like  a  natural  ^saster.  The  total  impact  of  the  problem  won’t  be 
known  until  after  midnight  31  Dec  99.  It  is  highly  likely  trouble  will  strike  regardless  of  our 
efforts.  Operational  planning  must  take  Year  2000  problems  into  consideration.  Commercial 
firms  are  ^eady  making  contingency  plans  for  fielding  disaster  recovery  teams  to  bring 
computer  systems  back  on  line.  Operational  commanders  need  to  do  the  same  to  meet  the  Year 
2000  aspects  within  (heir  area  of  responsibility. 

Determine  actions 

Based  upon  the  mission  risk  assessment,  determine  a  course  of  action  for  each  of  the  identified 
items  or  mission  rislb.  Items  can  be  fixed,  replaced,  or  ignored  based  iqwn  the  operational 
mission  risk.  Prioritize  resources  to  manage  and  resolve  multiple  Year  2000  infostructure  risks. 


Exit  criteria 

Item  compliance  determined  (if  possible) 
Resources  prioritized 
Actions  plaimed 

Implementation  Phase 
Purpose 

Implement  corrective  actions 
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Final  Report 
Reference 


Page  5 


Page  5 


Page  6 
Revised 


Actions 

Document  contingency  actions 

Document  any  contingency  actions  determined  in  the  previous  phase.  Contingency  actions  can 
be  documented  in  existing  operational  plans,  operations  center  checklists,  or  catastrophic  failure 
plans.  Organizations  must  update  disaster  and  catastrophic  failure  plans  to  include  Year  2000- 
based  scenarios. 

Mission  critical  items  must  have  their  failure  contingencies  documented  in  an  appropriate  plan. 
There  is  no  requirement  for  each  item  to  have  its  own  contingency  plan. 

Air  Force  wings  and  MAJCOMs  must  have  Y2K-specific  contingency  plans  (organizational 
plans,  not  to  be  confiised  with  specific  system  contingency  plans).  Future  versions  of  this 
document  will  identify  minimum  requirements  for  contingency  plans. 

Fix,  rqrlace,  or  ignore  items  (based  on  mission  risk) 

Fix,  replace,  or  ignore  items  for  which  you  are  responsible  Ensure  siqrpliers  resolve  problems 
on  items  they  supply  you-dmand  results. 

Mission  critical  items  must  be  fixed,  replaced,  or  have  their  failure  contingencies  documented  in 
an  appropriate  plan.  Items  with  little  mission  impact  (c.g.,  office  word  processing  PCs  have  very 
little  date  risk)  may  be  ignored.  There  is  no  Air  Force  requirement  to  fix  every  infrastructure 
item. 


Exit  criteria 

Item  fitilure  documented  in  an  appropriate  plan  (operations  plans,  checklists,  disaster  plans, 
Y2K  action  plan,  etc.) 

Items  fixed,  replaced,  or  ignored. 

(This  ends  the  quoted  material  fiom  the  AFMC  Y2K  PMP.) 


p.  4  Status  of  the  AFRL  Y2K  Program 

2nd  sentence:  Should  now  read,  "The  Air  Force  Research  Laboratory  has  met  all  required 
timeframes  of  the  AFMC  Y2K  Program  Management  Plan..." 

4fli  sentence;  Should  now  read,  "As  a  result,  the  AFRL  has  an  effective  effort  underway  for 
minimizing  any  year  2000  date-processing  problem." 

p.  4  Change  header  from  "Awareness"  to  "AIS/MIS  Awareness" 

Ist  sentence:  Should  now  read,  "The  AFRL  has  completed  all  required  AIS/MIS  Awareness 
actions  required  by  the  AFMC  Year  2000  PMP." 

p.  5  Change  header  to  "AIS/MIS  Assessment"  to  preclude  further  confusion. 
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4th  sentence:  Should  now  read,  *As  a  result,  the  AFflL  has  an  effective  effort  underway  for  minimlaing  any  year 
2000  date-processing  problem.' 

p.  4  Change  header  from  'Awareness'  to  'AIS/MIS  Awareness' 

1$t  sentence;  Should  now  read,  'The  AFRL  has  completed  all  required  AIS/MIS  Awareness  actions  required  by  the 
AFMC  Year  2000  PMP.' 

p  5  Change  header  to 'AIS/MIS  Assessment*  to  preclude  further  confusion 

1st  sentence:  Should  rrow  read.  The  Management  Plan  states  that  during  the  AIS/MIS  assessment  phase  all 
AISs/MISswill..* 

Last  sentence:  Should  now  read.  The  AFRL  has  completed  their  assessment  of  their  AtSs/MISs  and  has 
determined  that  none  of  them  met  the  AFMC  PMP  criteria  for  inclusion  in  the  Air  Force  Automated  System 
Inventory.' 

p.  5  Add  header  'Air  Force  Infrastructure  Approach' 

Bring  'Inventor/  out  to  left  margin  and  make  this  header  the  same  size  as  'Assessmenf  and  leave  information 
under  this  paragraph  the  same. 

Bring  header  out  to  left  margin  and  make  this  header  the  same  size  as  ’/Lssessmenf .  Change  header  from 
'Assessing  Systems...lmpact '  to  'Infrastructure  Assessmenl*  and  leave  information  under  this  paragraph  the  same. 

Leave  next  two  sub-paragraphs  at  the  indented  level  Leave  rest  of  area  the  same 

p.  6  Contracting 

2"^  paragraph,  last  sentence;  Should  now  read,  *.  .supported  by  contracting  divisions  at ...' 
p.  6  Contracting 

Header  now  should  read  'Contracting  at  the  Rome  Research  Site ' 

First  sentence:  Should  now  read.  The  AFRL  contracting  officials  at  the  Rome  Research  Site  reviewed  information 
technology  contracts. .  .* 

Second  sentence:  Should  now  read,  *  language  was  in  all  statements  of  work.* 

P-7 

First  paragraph,  first  sentence:  Should  now  read.  The  Operational  Contracting  Branch  supports  the  Rome 
Research  Site...* 

Third  sentence;  Should  now  read,  ‘officials  at  the  Operational  Contracting  Branch  determined..." 

Second  paragraph;  Header  and  first  sentence  should  now  read,  'Contracting  at  the  Wright  Research  Site.  The 
AFRL  contracting  officials  at  the  Wright  Research  Slte...research,  wWle  Aeronautical  Systems  Center  (ASC) 
Operationat  and  Central  Support  Division  contracting  officials...* 

Third  paragraph;  first  sentence:  should  now  read, '...  compliance,  Wright  contracting  officials.  ..* 

Second  sentence:  Should  now  read,  "Based  on  the  Wright  program  managers' ..." 

Third  sentence;  Should  now  read,  ‘...research  contracts,  Wright  contracting  officials...* 
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Page  8 
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Page  9 
Revised 


Fourth  Paragraph,  First  Sentence:  Should  now  read,  ‘The  Operational  and  Central  Support  Contracting  Dhnsion  at 
ASC  provides 

Second  sentence:  Should  now  read,  The  Operational  and  Central  Support  Contracting  Division  issued..." 

Last  sentence:  Should  now  read,  "A  review  of  the  Operational  and  Central  Support  Contracting  Division  contract 
files..." 

p.  8  Conclusion 

1st  sentence:  Should  now  read.  The  Managemer\t  Plan  required  AF  organizations  to  complete  AIS/MIS  Awareness 
and  AIS/MIS  Assessment  phases  by ..."  Add  two  sentences  that  should  read,  The  Management  Plan  further 
requires  AF  organizations  to  inventory  and  assess  their  particular  infrastructure  by  31  Mar  98  and  30  Nov  98, 
respectively.  AFRL  will  be  finished  with  their  assessment  phase  two  months  in  advance  of  the  30  Nov  98 
Management  Plan  deadline." 

'  2nd  sentence;  Should  now  read,  ‘Review  of  AFRL  identified  that  the  laboratory  is  on  schedule  with  the  timeframes 
established  in  the  Management  Plan.* 

Suggest  adding  another  sentence  after  the  2nd  sentence  that  reads.  To  further  ensure  AFRL  stays  on  schedule, 
the  Chief  Information  Officer  has  now  tasked  everyone  in  AFRL  to  review  their  areas  of  responsibility  by  first  reading 
the  AFRL  Y2K  Best  Engineering  Practices  memo.  This  memo  has  since  been  added  to  the  AFMC  Y2K  PMO's  Best 
Practices  page  within  their  website." 

Last  sentence"  Should  now  read,  "We  believe  that  the  AFRL  has  established  an  effective  process  that  should  assist 
in  minimizing  any  year  2000  date-processing  problems." 

AS  I  said  earlier,  if  there  are  any  questions,  call  or  e-mail  me. 


Michael  J.  Monroe,  Major,  USAF 
Senior  Information  Resource  Manager 
AFRL  Y2K  Program  Manager 
AFRL/CCI 

Voice:  dsn  986-9756  commercial  937-656-9756  fax:  dsn  765-2046  or  937-255-2046  email;  monroem@afri.af.mil 
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